CVE-2026-59257: N8n Workflow Automation SQLi Vulnerability

CVE-2026-59257 Overview

CVE-2026-59257 is a SQL injection vulnerability in n8n, the workflow automation platform. The flaw exists in the legacy MySQL v1 node's executeQuery operation, which substitutes evaluated {{ ... }} expression values directly into raw SQL strings without parameterization. When a workflow uses this operation with expression-sourced values and connects to an externally-reachable trigger such as a Webhook node, attacker-controlled input reaches the SQL statement. This allows execution of arbitrary SQL with the configured MySQL credentials' privileges. The MySQL v2 node uses parameterized queries and is not affected. The issue is tracked under [CWE-89] (SQL Injection).

Critical Impact
Attackers who can influence webhook-fed workflow inputs can execute arbitrary SQL against the connected MySQL database, exposing or modifying data with the credentials' full privileges.

Affected Products

n8n versions before 1.123.61
n8n 2.x versions before 2.27.4
n8n 2.28.x versions before 2.28.1

Discovery Timeline

2026-07-08 - CVE-2026-59257 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-59257

Vulnerability Analysis

The vulnerability resides in the MySQL v1 node's executeQuery operation within n8n workflows. n8n allows users to embed expressions using {{ ... }} syntax that are evaluated at runtime against workflow data. In the legacy MySQL v1 node, these evaluated values are string-concatenated into the raw SQL statement rather than passed as bound parameters. When a workflow is triggered by an externally-reachable node such as a Webhook, an unauthenticated attacker can supply crafted input that flows through expressions into the SQL string. The injected SQL executes with the privileges of the configured MySQL user, enabling data theft, tampering, or destructive operations depending on grants.

Root Cause

The root cause is missing parameterization in the MySQL v1 node's query construction path. Instead of passing expression-derived values as bound parameters, the node interpolates them into the SQL text prior to execution. This design predates the MySQL v2 node, which correctly uses prepared statements and bound parameters.

Attack Vector

Exploitation requires a workflow that uses the MySQL v1 node's executeQuery operation with expressions sourced from an external trigger. The attacker sends a crafted HTTP request to the exposed Webhook endpoint. Malicious payload content flows through the expression evaluator into the raw SQL string, allowing statement chaining, subquery injection, or UNION-based extraction. Refer to the VulnCheck SQL Injection Advisory and the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-59257

Indicators of Compromise

Webhook requests containing SQL metacharacters such as single quotes, --, ;, or UNION SELECT targeting n8n endpoints.
MySQL server logs showing unexpected statements like INFORMATION_SCHEMA enumeration, SELECT ... INTO OUTFILE, or DDL executed from the n8n service account.
Workflow execution logs referencing the MySQL node (v1) with anomalously long or malformed query strings.

Detection Strategies

Audit all n8n workflows for use of the legacy MySQL v1 node and flag any executeQuery operations that reference expression values ({{ $json.* }}) sourced from Webhook, Form Trigger, or similar external nodes.
Enable MySQL general query logging on databases connected to n8n and alert on query patterns inconsistent with the workflow's documented purpose.
Correlate n8n webhook access logs with downstream database activity to identify request-to-query anomalies.

Monitoring Recommendations

Monitor n8n execution history for failed or unusually long-running MySQL queries triggered by webhook events.
Alert on MySQL authentication using the n8n service account outside expected source IPs or hours.
Track version metadata across n8n deployments and flag hosts running versions earlier than 1.123.61, 2.27.4, or 2.28.1.

How to Mitigate CVE-2026-59257

Immediate Actions Required

Upgrade n8n to 1.123.61, 2.27.4, 2.28.1, or later depending on the deployed branch.
Migrate all workflows from the legacy MySQL v1 node to the MySQL v2 node, which uses parameterized queries.
Restrict privileges on the MySQL account used by n8n to the minimum required tables and operations.
Review recent webhook-triggered workflow executions for evidence of injection attempts and rotate database credentials if compromise is suspected.

Patch Information

n8n has released fixed versions 1.123.61, 2.27.4, and 2.28.1. Details are documented in the n8n GitHub Security Advisory GHSA-hwmj-qg4v-cvg9. Operators of self-hosted n8n instances should upgrade via their package manager, container image, or deployment automation.

Workarounds

Replace MySQL v1 executeQuery operations with the MySQL v2 node in all affected workflows.
Where migration is not immediately possible, remove expression interpolation from SQL statements and hardcode values, or gate webhook triggers behind authenticated proxies with strict input validation.
Place n8n behind a web application firewall configured to block SQL injection patterns on webhook paths until patching is complete.

bash

# Example: upgrade a self-hosted n8n Docker deployment to a fixed release
docker pull n8nio/n8n:1.123.61
docker stop n8n && docker rm n8n
docker run -d --name n8n -p 5678:5678 \
  -v ~/.n8n:/home/node/.n8n \
  n8nio/n8n:1.123.61